Your on-premises network contains an Active Directory Domain Services (AD DS) domain named contoso.com.
The domain contains a domain controller named dc1.contoso.com.
You have a Microsoft 365 E5 subscription that uses Microsoft Intune Suite.
You have an Azure subscription that contains the resources shown in the following table.
The subscription contains the virtual networks shown in the following table.
You plan to deploy Windows 365 Enterprise Cloud PC.
You need to create an Azure network connection (ANC) that will use Microsoft Entra hybrid join.
Which virtual network can you use for the ANC?
A. VNet1 only
B. VNet2 only
C. VNet3 only
D. VNet1 and VNet2
E. VNet1 and VNet3
Show Answer
Correct Answer: A
Explanation: For a Windows 365 Enterprise Azure network connection (ANC) using Microsoft Entra hybrid join, the selected virtual network must be able to resolve the on-premises AD DS DNS namespace using AD DS DNS servers and have network connectivity to a domain controller. Based on the scenario, only VNet1 satisfies the required DNS/domain controller connectivity prerequisites. Therefore, only VNet1 can be used for the ANC.
Question 137
HOTSPOT
-
You have a Microsoft 365 E5 subscription that uses Microsoft Intune.
You need to ensure that users can only enroll devices that meet the following requirements:
• Android devices that support the use of work profiles.
• iOS devices that run iOS 11.0 or later.
Which two restrictions should you modify? To answer, select the restrictions in the answer area.
NOTE: Each correct selection is worth one point.
Explanation: Block Android Device Administrator enrollment so only Android Enterprise (work profile) devices can enroll. Set the iOS/iPadOS minimum enrollment version to 11.0 to prevent older iOS devices from enrolling.
Question 138
You have a Microsoft 365 subscription that contains 500 computers that run Windows 11. The computers are Microsoft Entra joined and are enrolled in Microsoft Intune.
You plan to manage Microsoft Defender for Endpoint on the computers.
You need to prevent users from disabling Microsoft Defender for Endpoint.
What should you do?
A. From the Microsoft Intune admin center, create a security baseline.
B. From the Microsoft Intune admin center, create an antivirus policy.
C. From the Microsoft Entra admin center, create a Conditional Access policy.
D. From the Microsoft Intune admin center, create a device compliance policy.
Show Answer
Correct Answer: B
Explanation: To prevent users from disabling Microsoft Defender for Endpoint/Defender Antivirus on Intune-managed Windows 11 devices, configure Tamper Protection through an Intune Endpoint Security Antivirus policy. Antivirus policies are the intended management surface for Defender Antivirus settings, including tamper protection that prevents users from turning off protection. Security baselines may include recommended settings but are not the primary mechanism for this specific requirement. Conditional Access and device compliance policies do not prevent users from disabling Defender.
Question 139
You have a Microsoft 365 subscription.
Each user is assigned a Windows 365 Enterprise license.
You need to deploy Cloud PCs that will be Microsoft Entra hybrid joined.
What should you do first?
A. Create an Azure network connection (ANC).
B. Create a provisioning policy.
C. Create a configuration profile in Microsoft Intune.
D. Upload a custom image.
Show Answer
Correct Answer: A
Explanation: For Microsoft Entra hybrid joined Windows 365 Enterprise Cloud PCs, the first deployment prerequisite is creating an Azure network connection (ANC). The ANC connects Cloud PCs to your Azure virtual network with line-of-sight to on-premises domain controllers, which is required for hybrid join. After the ANC is validated, you can create a provisioning policy that references it. Configuration profiles and custom images are optional or later-stage tasks.
Question 140
You have a Microsoft 365 subscription that has Windows 365 Enterprise licenses.
You plan to use a custom Windows 11 image as a template for Cloud PCs.
You have a Hyper-V virtual machine that runs Windows 11 and has the following configurations:
• Name: VM1
• Disk size: 64 GB
• Disk format: VHDX
• Disk type: Fixed size
• Generation: Generation 2
You need to ensure that you can use VM1 as a source for the custom image.
What should you do on VM1 first?
A. Change the disk type to Dynamically expanding.
B. Change the disk format to the VHD.
C. Change the generation to Generation 1.
D. Increase the disk size.
Show Answer
Correct Answer: B
Explanation: Windows 365 custom images uploaded to Azure must use the VHD format. A Generation 2 VM is appropriate for Windows 11, and a fixed-size VHD is acceptable. The current blocker is that the virtual disk is VHDX, which must be converted to VHD before it can be used as a custom image. Increasing the disk size or changing to Generation 1 is unnecessary, and changing to a dynamically expanding disk is not required.
Question 141
HOTSPOT
-
Your on-premises network contains an Active Directory domain named contoso.com. The domain contains a user account named Admin1 and the resources shown in the following table.
You have a Microsoft 365 E5 subscription.
You have a Microsoft Entra tenant that syncs with contoso.com.
Admin1 plans to use Windows Autopilot to deploy 100 Windows 11 devices. The deployment must meet the following requirements:
• The devices must be Microsoft Entra hybrid joined during the deployment.
• Computer objects must be created in OU1.
You need to configure Server1 and Active Directory delegation to support the deployment.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Server1: Install the Intune Connector for Active Directory.
Resource: OU1
Explanation: Windows Autopilot for Microsoft Entra hybrid join requires the Intune Connector for Active Directory on an on-premises server. To allow computer accounts to be created in the target organizational unit, delegate permissions on OU1 to the connector/server account.
Question 142
You have a Microsoft 365 E5 subscription.
You use Microsoft Intune to manage all devices.
You need to prepare a Win32 app named App1.exe for deployment.
What should you do first?
A. From the Microsoft Intune admin center, create an app configuration policy.
B. Change App1.exe to the INTUNEWIN format.
C. From the Microsoft 365 Apps admin center, create a deployment configuration.
D. Upload App1.exe to Azure Blob Storage.
Show Answer
Correct Answer: B
Explanation: To deploy a Win32 application with Microsoft Intune, the installation source must first be packaged into the .intunewin format using the Microsoft Win32 Content Prep Tool. Intune uploads and deploys Win32 apps as .intunewin packages, not raw .exe files. App configuration policies, Microsoft 365 Apps deployment configurations, and Azure Blob Storage are not the first preparation step.
Question 143
You have a Microsoft 365 subscription that includes Microsoft Intune.
You need to deploy a custom app to Android devices. The app uses the APK file format.
Which type of app should you select for the deployment?
A. built-in
B. Android store
C. Managed Google Play
D. line-of-business (LOB)
E. web link
Show Answer
Correct Answer: D
Explanation: For an Android app distributed as an APK file directly through Microsoft Intune, the appropriate app type is Line-of-business (LOB). LOB apps are uploaded from an APK installation package and are intended for in-house/custom applications. Managed Google Play is used for Play Store apps, including private apps published through Managed Google Play, but the question only states a custom APK to deploy, which maps to the LOB app type.
Question 144
You have a Microsoft 365 subscription that uses Microsoft Intune Suite.
You use Intune to manage Windows 11 devices.
You need to implement Windows Local Administrator Password Solution (Windows LAPS).
What should you configure?
A. a configuration profile
B. an account protection policy
C. an app protection policy
D. a device compliance policy
Show Answer
Correct Answer: B
Explanation: Windows LAPS in Microsoft Intune is managed through Endpoint security > Account protection policies. These policies configure LAPS settings such as password backup, rotation, and local administrator account management for Windows devices.
Question 145
HOTSPOT
-
You have a Microsoft 365 E5 subscription that contains the security groups shown in the following table.
The subscription contains devices that run Windows 11, version 21H2 as shown in the following table.
You have a feature update deployment profile named Deployment1 as shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Device1: No
Device2: Yes
Device3: No
Explanation: Group2 includes all Windows devices. Group3 includes devices with extensionAttribute1='Test' (Device1). Group1 contains Device3. The deployment includes Group2 but excludes Group1 and Group3, so excluded membership overrides inclusion.
$19
Get all 373 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
